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ALL INFOKMATIQH CXIWTAINEO 

HEREIM IS UNCLASSIFIED 

DATE 08-1S-2O14 BY F4€iI82K40 N3ICG 


(Rev.l(M)I.l999). 


FEDERAL BUREAU OF; INVESTIGATION 


Precedence ; ROUTINE 
To: Tampa 

From: Tampa 


Date:. 09/21/2000 




Contact:. 
.Approved By:| 
•Drafted By: 


SA^ 


.Case ID 288A4 TP-n 4W 
Title: 


UNSUB(SL 
WALT DISNEY WORLD - VICTIM;- 
SiON' - INFO..SYSTEM; 

P 


Synopsis: Recommendation to open and as sign case based .upon 

^r>vir>ni interview with Walt -Disney World 


Details: P:0. iBOx 10000, Lake Buena Vista, 

Florida, 32830, telephoned and reported that a computer system; 
which contains patron credit card and ^personal information.-has 
been accessed ‘by -an Unknown .and. Unauthorized person Or persons. 


r 


stated, that .the .intrusidn .was discovered bv a 


stated that[ 
intrusion . 


will ‘furnish technical details of the 


stated that the victim 'server (computer) has 
■been disc onnected form, the network and has not .'been modified. 

stated !that Disney .,is personnel -are .awaiting 
instructions from the FBI. 


above. 


♦♦ 


.Recommend case, be Opened and assigned ^as captioned' 


b6 

b7C 

b7E 


b6 

b7C 










ALL INmRlSLTION CGBTTAItlED 
HEREIN IS UNCLASSIFIED 
DATE 08-1S-2014 BY F4€lfS2K4 

















JILL imasmLTim Em-urnmn 
HEEIIW IS UNCLMSIFIID 

IjilllllllB^^^ 



FD-340(Rcv,S-7-97) 



Receipt Given □ Yes □ No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
□ Yes ONo 

Title: 



b6 

b7C 


'"'^b6 

'^bTC 






_ y-/ P 



f 




P^LA_ 



'fX)h 










ALL INFOKBrnTIOM CGETTAINEO 
HEEEIN IS UNCLASSIFIED 


DATE Oe-lS-2014 BY F4€MS2KT40 NSICG 
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MJL imasmiTim acMTmmB 

HlllIM IS UNCLASSIFIED 

DA.1*! Oe-lS-2014 BY F4€MS2KT40 NSICG 


FD-340 (Rev. $-7-97) 


Universal Case File Number 1 ^ 4>C> 

Field Office Acquiring Evidence " •/"•TCVa^PA- 


/4 



Serial # of Originating Document. 
Date R eceived // /t^t /z€>pp_ 


From 


J)f Contributor) 


/k/^/^wnsyt c:?gvu7-g>^ 


b6 

b7C 


/iTL/}r7/r/i 


(Address of Contributor) 



To Be Returned O Yes O No 
Receipt Given □ Yes □ No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e| 

Federal Rules of Criminal Procedure — ^ 

l^Yes ONo 
Title: ^ 


.. 


Reference:, 


(Communication Enclosing Material) 


Description: □ Original notes re interview of 
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Peel and Stick FedEx USA Airbill 

1. Complete front page of the Airbill. 

2. Retain "Sender's Copy" foryour records. 

3. Remove label backing. 

4. Adhere Airbill to front of package. 

Please DO NOT remove "FedEx Copy." 


PEEL FROM THIS CORNER. 
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By 
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To Be Returned O Yes No 
Receipt Given O Yes f3 No 

Grand Jury Material - Diss sminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
O Yes Cp No 

Title: 
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Reference: 


(Communication Enclosing Materia!) 


Description: □ Original notes re interview of 
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FD-192 

Title and Character — 

WALT DISNEY WORLD 

Date Property Acquire 
09/22/2000 


_vcii>jaw 








-//^// 


I Acquired! 
.Y WORLD 


09/26/00 

13:01:33 


ICMIPROl 
Page 1 


Anticipated Disposition:, ftormiraii mr- 

-Description of Property: 

IB 1 

MAXELL "CD-R 650MB" COMPUTER COMPACT DISK 
Barcode: E01881337 Location: ECRl 



b6 

b7C ' 

Date Entered 


r*'-\rtr% 7\rmrtf* 


09/26/2000 


Case Number: 288A-TP-51940 

Owning Office:- TAMPA 






ALL IMfORMATiaN CX3NTAINED 
HEKEIN IS Ul'ICLASSITIED^ 

DATE 0S- 15-2014 3V I4 61I82K40 HSIC 


Case ID 


Accepted B 
Reaso 


Accepted By 
Reason 

Accepted By 
Reason 


Accepted B 
Reaso 



Accepted By; 
Reason : 


Chain of Custody FD-192 


-51940 


Date Time 





Accepted By: 
Reason: 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason: 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By; 
Reason ; 




JILL IMmE^fXGiiil 


09/26/00 


ICMIPROl 

13:01:54 

FD-192 

Page 1 

1 3 


Title and Character of Case: ^ 


[ 

WALT DISNEY WORLD 


1 


Date Property Acquired: Source-rrom~wnxcn-yropercv' Accruired i 


09/23/2000 


Anticipated Disposition : Accruired Bv: 


Description of Property: 
IB 2 


raflp. AqAn^-» 


b6 

b7C 


Date Entered 


MAXELL "CD-R 650MB", COMPUTER COMPACT DISK 

Barcode: E01881338 Location: ECRl / 09/26/2000 


Case Number: 288A-TP-51940 

Ovming Office : TAMPA 











DIkm IIIIIIIIM^^ 


>>;, OS/21/00 
16:17:34 


FD-192 


Title and Character of Case: 


WALT DISNEY WORLD 


Date Property Acquired: Source 






09/22/2000 


Anticipated Disposition: 


Description of Property: 
IB 3 




Date Entered 


3 1/2" FLOPPY DISK, 3M BRAND WITH "SONY" LABEL 
Barcode: E01881339 Location: ECRl /S££^ 


09/26/2000 


Case Number: 288A-TP-51940 

Ovming Office: TAMPA 





cxmtmned ' 

phsiM n UMVLASSIFIED^ 

IftTE 08-1S-2014 BY F46M82K40 WSlcG 


Chain of Custody PD- 192 


b6 

b7C 


Case ID . . 


Accepted By 
Reason 




TP- 51 940 


1B3 


Date Time 





Accepted By; 
Reason ; 


Accepted By; 
Reason; 


Accepted By; 
Reason ; 


Accepted By; 
Reason; 


Accepted By; 
Reason ; 


Accepted By: 
Reason ; 


Accepted By: 
Reason: 


Accepted By: 
Reason : 


Accepted By; 
Reason ; 


Accepted By; 
Reason ; 


Accepted By: 
Reason : 


Accepted By: 
Reason ; 


Accepted By; 
Reason ; 


Accepted By: 
Reason ; 
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HEEE 


Chain of Custody FD-192 


Case ID . ., 


Accepted Bjn 
Reason^: 

Accepted By; 
Reason : 

Accepted By: 
Reason : 

Accepted By: 
Reason : 

Accepted By: 
Reason : 

Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason; 

Accepted By; 
Reason ; 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


s0S>-51940 



Date Time 




//V 


Y/f 



2/^j 








Accepted By: 
Reason: 


Accepted By: 
Reason : 



Chain of Custody FD-192 

I 



Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
Reason ; 


Accepted By: 
Reason : 


Accepted By: 
Reason : 


Accepted By: 
. Reason : 


Accepted By: 
Reason : 
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HEBE IN I S UMVLASSIFIED^ 

DATE 08-1S-2014 BY F4€M8jililllBiliii 


• 


09/26/00 r 


ICMIPROl 

13:01:33 

FD-192 


Page T 


Title and Character of Case: 


WALT DISNEY WORLD 


Date Property Acquired: 
09/22/2000 


Source from whiph Property Acquired: 

‘WALT DISNEY WORLD 


b6 

b7C 


Anticipated Difipofiition - Acquired Bv: Case Agent : 

Description of Property: Date Entered- 

IB X 

MAXELL "CD-R 650MB" COMPUTER COMPACT DISK 

Barcode: E01881337 Location: ECRl 09/26/2000 


! 

1 

“ Case Number: 288A-TP-51940 

! Ovming Office; T^PA 







ALL INmRMATIGM 

HEBE IN I S UMVLAS S IFIED^ ' 

DATE 08-1S-2014 BY F4€M82#l i llBilill 


09/26/00 

JL3;0l:54 


Title and Character of Case: 
WALT DISNEY WORLD 


PD-192 


ICMIPROl 
Page 1 


Date Property Acquired: Source from which Property Acquired: 

INCIDENT RESPONSE SPECIALIST 

09/23/2000 


b6 

b7C 


Anticipated Disposition.: Acmiired Rv: 


Case Agent: 


Description of Property: 

IB 2 

MAXELL "CD-R 650MB", COMPUTER COMPACT DISK 
Barcode ^ E01881338 Location: ECRl 


Date Entered 


09/26/2000 


I 

I 





ALL 

DATE Oi-lS-2014 B¥ r4€MS2K40 


09/27/00 

16:17:34 


# 

FD-192 


ICMIPROl 
Page 1 • 


- - - - - 

Title and Character of Case: 


WALT DISNEY WORLD 


Date Property Acquired; 
09/22/2000 


fimirra frnm which Property Acquired: 


b6 

b7C 


Anticipated Disposition; Acquired Bv: 

Description of Property: 

IB 3 

3 1/2" FLOPPY DISK, 3M BRAND WITH "SONY" LABEL 
Barcode: E01881339 Location: ECRl 


<^age> Arfont- . 


Date Entered 


09/26/2000 




Case Number: 288A-TP-51940 

Owning Office: TAMPA 
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FEDERAL BUREAU OF INVESTIGATION 


I 


.Precedence: IMMEDIATE 

To:- Tampa. 

rFrom: Tajnpa' 

Contact: 

Approved By 

Drafted By: 

Case ID #: 288A-TP-51940-^ 
66F-TP-44851 


Title: UNSUB (S); 

WALT DISNEY WORLD - VICTIM; 
INTRUSION - INFO SYSTEM; 
00:TP 


Date: 09/27/2000 

Attn: CART Supervisor 



b6 

b7C 

b7E 


Synopsis: Request for C ^T examinat ion regarding captioned case 

per conversation with :SA* 


b7E 









[ill 



BATE 08-1S-2014 HY F4€M82K4D NSIDG 




'U.S.'bepartmeht of justice 


Federal Bureau of Investigation 


I la Reply, Please Refer to 
FUeNo. 


‘500 East Zack ’Street 


October 12 , ,2000 


b7C 

b7E 


Re: Internet connection logs 


Dear 


You are respectfully notified to preserve.all records, 

logs , ' Hnr’iTm<ant-ahif>n anrl tP'VT frV-r t-hr> c!A-rv|> r-A 

connection! . tor 

the :period [tnrougn 


■documentation or other 


You; 


are to preserve aix recoras, Jtogs, 

.evidence as noted , above pursuant to Title 18 United ’States i,C6de 
Section- 2703 (f) for an, initial period of ninety (90) days.. 


You are further requested ;not to disclose the existence 
of or compliance with this notificatioii. Any such -disclosure 
could seriously impair lan dn-going investigation into violations 
of United States Federal Criminal Law. 






\ALL IHFOmSiTIOM DDNTAINSC 
IB mZLASBlzIZB 

DATE OS- 13-2014 3Y F4 5::82K40 hsICG 


(Rcv/OMS-iOOO) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence : 
To: 


PRIORITY 


Date: 10/13/2000 


Attn: ALAT 



Title: UNSUB (S); 

WALT DISNEY WORLD COMPANY - VICTIM; 
INTRUSION ' INFO SYSTEM; 

00:TP 


Synopsis: Set lead fox 

ah tbAr 
m. 

L 

to serve oreservation of 




1 


Enclosure (s) : Preservation of evidence letter pursuant to Title 

18 U.S.C. Section 2703(f). 


Details: Per 

requests ALAT 
evidence letter to| 
r>f Y-Arr>Y-^g r 


tel cal, with SSA 


Tampa 


1 fif>rv^/d<=>Tivpr rnp Pnrin.cjpn pT^?gfi^rva^^r.n of 


or Other custodian 


The request is specifically to preserve user connection 
records for the Internet mr ar:r!mmh<:! hhah the 

r>y-r>tT>rr>1 


through [ 




ascertain the 
ruture cdurt orders or 


It is further requested that 
likelihood of compliance with possible 
sxibpoenas and provide Tampa a point of contact to whom future 
correspondence will addressed. 


b6 

b7C 

b7E 


b6 

b7C 

b7E 





r <is> 


To: 
Re : 


2SSA-TP 


3 


From:- Tampa 
940, 10/13/2000 


LEAD(s) : 

S et Lead 1: 

I , b7E 

Serve preservation of evidence letter and request 
subscriber information per details section of EC. 

♦♦ 


2 



M lllliiiios^ 

D&riillll l l lB ^^ 


n>-54J(R«v.n-02-l»9) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence ; 


ROUTINE 


Date: 10/18/2000 


To: Counterterrorism 


From: 


contact 


Attn; 


Approved By: 
Drafted By: 


Case ID #: 288-TP-C42877 




Title: NIPGIP Investigative Accomplishments 

Synnnaia: All NT PCI P Investigative accomplishments to date for 

SA per Counterterrorism EC dated 8/21/2000. 

Details: SA | ~ captured investigative accomplishments 

for the period January 1999 to present per Counterterrorism EC 
dated 08/21/2000. 


files: 


The statistics were recorded from the following 288 case 


288A-TP-48550 

288A-TP-50824 

288A-TP-51201 

288A-TP-51940- 

288A-TP-50809 

288A-TP-49236 

288A-TP-49698 

288A-TP-50999 

288A-TP-49214 

288A-TP-49192 

288A-TP-51037 


plus informant and cooperating witness files. 


Should CIi 
please contact SA 




statistics, 





-if' 6^40 
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To: Counterterrorism From: Tampa 

Re: 288-TP-C42877, 10/18/2000 


Accomplishment Information: 

Number: 6 

Type: NIPCIP VICTIM CONTACTED/ INTERVIEWED 

ITU: NIPCIP \ 

Claimed Byi j 1 

SSN: 

Name: 


Number: 1 

Type: NIPCIP SUBJECT TOOL/EXPLOIT/MALICIOUS CODE IDENTIFIED 

ITU: NIPCIP 

Claimed By^ , 

SSN: 

. Name : 


Number: 2 

Type: NIPCIP FOREIGN SOURCE IP ADDRESS IDENTIFIED 

ITU: NIPCIP 

Claimed Byf 1 

SSN: 

_ Name : 


Number : 3 

Type: NIPCIP SEARCH WARRANT OBTAINED 

ITU: CART 

ITU: NIPCIP 

Claimed By : 


SSN: 

KTarriA ■ 





Number: 2 

Type: NiPCIP SEAJRCH WARRANT EXECUTED 

ITU: CART 

ITU: NIPCIP 


Claimed By:i 
SSN: 


Number : 2 

Type: NIPCIP 2703(f) ORDER SERVED 

ITU: NIPCIP 

Claimed By? . 

SSN: 

Name : | 


b6 

b7C 

b7E 
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To: 

Re: 




Counterterrorism From: , Tampa 
288-TP-C42877, 10/18/2000 


Squad : 6 

Number : 1 

Type: NIPCIP 2703(d) ORDER SERVED 

ITU; NIPCIP \ 

Claimed By,: i 

SSN:. 

. Name ; 


Number : 1 

Type: NIPCIP 2703(d) ORDER OBTAINED 

ITU: NIPCIP 


Claimed By 
SSN: 
Name: 


Number: 9 

Type: NIPCIP CONSENSUAL MONITORING CONDUCTED 

ITU: CONSENSUAL MONITOR 

ITU: NIPCIP 


Claimed By 
SSN: 
Name: 


NumbeiJ— ® 

Type: 

ITU: 'nTPCTP" 

Claimed Byj 
SSN: 
Name; 


b3 

b6 

b7C 
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Number: 6 

Type: NIPCIP SUBJECT IDENTIFIED 


ITU 

ITU 

ITU 

ITU 

ITU 

ITU 


CART 

CONSENSUAL MONITOR 
CONSENSUAL SEARCH 
NIPCIP 


SSN: 
Name : 





Number : 6 

Type: NIPCIP SUBJECT INTERVIEWED 


3 
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To: Counterterrorism From:' Tampa 

Re: 288-TP-C42877/ .10/18/2000' 



I'TU: NIPCIP , 

Claimed’ Byi 1 

SSN: 

Name; 

I n 

Number: 1 

Type:. NIPCIP INFORMANT/ASSET .DEVEIXJPED' 
ITU:- NIPCIP 

Claimed By 1 1 

SSN:'- 

Name : I , 


b6 

b7C 

b7E 


.Number: 1 

Tyjpe :■ NIPCIP COOPERATING 'WITNESS’ OPENED 

-ITU: ;nipcip 

Claimed .By:i ■ 

SSN: 

.Name: 



To: Counterterrorism From: Tampa 

Re: 288-TP-C42877, 10/18/2000 


LEAD(s): 

Set Lead 1: (Adm) 

\ 

COUNTERTERRORISM 

\ 

■ AT WASHINGTON. DC 
For information. 


♦♦ 
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-I- 

FEDERAL BUREAU OF INVESTIGATION 


Date oftraascripticn 09/27/2000 


Date of l^irhh f 

gpriimihv Anrnimf. Niirpher (SSMT) 


]so£iial 


Informatioii bervicey, 
Vista, 


b6 

b7C 


wait Disney woria 

Florida, was interviewed at his place of 


Udrtlpahy, BU6ha 

employment. After being advised of the identity of the 
interviewing Agent and purpose of the interview he voluntarily 
provided the following information; 


^_stated that he 

£iamQUtiina_eiuiiroirnent_ax:d_that 


xs_al 


ai 


for the distributed 
so present, is the 


sated that the "Leave a Legraev" 
the EPCOT parK, is supported by computers, 
several SILICON GRAPHICS INCORPORATED (SGI I 

IRIX operating system (OS) and a ,PC witVj the LINUX operating system 


may have been accessed illegally, 


T ttraction within 
stated that 
computers, with the 


explained that the LINUX 


computer was a "File Transfer Protocol" (FTP) server which Walt 
Disney World Company used to store "tif" files which are later 
transferred to KODAK COMPANY and their subcontractors in order to 
facilitate the making of plaques. The plaques are then returnpd tn 
WALT DISNEY WORLD and placed on walls within the EPCOT park. 


stated that EPCOT patrons pay WALT DISNEY WORLD for the service 


[stated that there are four (4) 


directories on the 


LINUX FTP server which contained customer data. } 
that three (3) of the directories contain files which are encrypted 
utilizing triple Digital Encryption Standard (DES) and the fourth 
directory contained files which were saved in clear text. 


i 


sated that the clear text file cont 
ao'orss'srsfe and phone numbers of EPCOT patrons 


names, 

explained that the "ti.f" files normally contained 
(300) to four hundred (400) individual 


tt aing imarrp gj 

r 

tui«;u juuiiured 


was used to FTP the files to KODAK and other places. 


files and that a "cron job" 


b6 

b7C 


the FTP server,* 


sated that four entities were authorized to access 
KODAK, The Disney Internet Group (DIG) , Feathering, 


a mail order company and the Disney Marketing Group. 


I 


Investigttion oa 09/22/2000 *< Lake Buena Vista, Florida 


Fil« « 28a T\-TP.K1 Q<1 
by SA 





D*tc dictated 09/27/2000 


This document contauos neither recc«otfnett<3ations oof coaclusietw of the FBI, It is the jffoperty of the FBI ajod is louoed to yowf agency; 
it and its contents are to he distributed outside your agency. 


- / 
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288A-TP-51940 


CoadtMatioa cf F1X302 of 


.On 09/22/2000 .P»ge -2- 


down and 


stated that Wednesday afternoon the network slowed 
amounts of data were flowing and that is when 


technicians grew concerned. 


I [explained that a Firewall had been removed from the 

Internet connection several months earlier for an unknown reason 
and that the removal of the firewall left the FTP Server and 
associated network segment, which was connected to the Internet, 
unprotected. 


stated that also connected to that segment of the 
network Was a computer which contained executable computer code 
which is used to control rides within the parks at WALT DISNEY 


WORLD. 


state that, although remote, it is possible that the 


execucauie could have been accessed. 


b6 
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technical 


ptated that his staff would provide additional 
re and cooperate fully. 
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Fax Transmission 


Offipfi nf fhp T.paal Affarhp 


To: 


GRI 


Date: October 26, 2000 


Fax#^: 


Pages: 3, including this cover sheet. 


Voice #: 
From: 

Subject: 


(Assistant Legal 

Attache 

Computer Intrusion - Walt Disney World Info System (our file # 288A-TP*51940) 


Comments: 


b6 

b7C 

b7E 


Gentlemen, 


Colleagues in our Tampa, Florida office, are investigating an appare nt computer intrusion 


into the data svstfimg at Walt nisnfty World in Orlando, Florida. The hackei[ 


|to perpetrate the crime. As is always the case, preservation of 

the user connection records, maintained by the BP, is vital to the successful investigation and 
prosecution of this matter. 


b7E 


Enclosed are two “Evidence Preservation” letters which are addressed to the BP in 
question. The letters list the specific times and log references which the investigators are 
interested in. Please provide the letters to the IP as soon as possible before the vital information 
is erased. 


The Tampa colleagues are also highly interested in obtaining subscriber infoimation 
regarding the Internet accounts listed on the enclosed letters. Please advise if this is possible 
and/or if more detailed information is needed before the subscriber identification can be provided. 

Thanks for the assistance. 



b6 
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INDEXED 

serialized__4^S 

EILEO 


mft -T/’ -si^^o-os> 




HSREIM 

PATE 



U.S. Department of Justice 


Federal Bureau of Investigation 


; in Reply, Please Refer to 500 East Zack Street 

FileKo. 


October 12, 2000 


Re:- Internet connection logs. 


b6 

b7C 
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Dear 


I 


You are respect fulTy notified to preserve all records, 
logs,, documentation and other evidence for the -Internet service 

connection | 

tihe period ot I 


I 


as ! noted above pursuant to iTitle 18 United' States Code 
Section 2703(f) for an initial period of ninety (90) days. 

You are further requested not to disclose the existence 
of or 'compliance with this notification. Any such disclosure 
could- seriously impair an On-going investigation into violations 
of ‘United States Federal Criminal Law. 


If you have any qu estions regardi ng 


please contact Special ‘Agent 


at 


this notification 


b6 

b7C 


Sincerely, 


Francis A- Gallagher 
Special Agent dn Charge 


JBiti I 

Supervisory Special Agent 





pMS IM I S 

DIkTE Oe-19-2014 B¥ F4€MS2E40 hsICG 
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jioioioioiotoiait*********** DATE. TIME, 13‘06. *** P.01 


START-CCT-SE 13 : 0S‘ END»CCT-26 .13.: 06 


mode;:- memory TRPNSMISSI.ON 
FILE NOV- 002 

STN no;. dOM ABBR NO. STftTi;0N NPIME/TEL..NO'. PftCES; "DURATION 

001 OK <2Z> CRI 003/^. 00: 00 ’’5 1." 

-lecat| 


-mm: 



FAX Transmission 

Office of the Legal Attache 


to: 

CRI 


Date: October 26 , 2000 


Fax#; Pages; 3. including this cover sheet. 

Voice#; 


From: 

Subject:- 


lAssistantLegal 

Attache 

Computer Intrusion - Walt Disney World Info System (our file # 288A-TP-51940) 


'Comments: 


Gentlemen, 

Colleagues in our Tampa, Florida office, are investigating an appare nt computer intrusion 
intft thft at Walt nktifty Wftrid jn Otlando, Florida. The hacker j^ I 


to perpetrate the crime. As is always the case, preservation of 
the user connection records, maintained by the IP, is vital to the successful investigation and 
prosecution of this matter; 


Enclosed are two “Evidence Preservation” letters which are addressed to the IP in 
question. The letters list ihe specific times and log references which the investigators are. 
interested in. Please provide the letters to the IP as soon as possible before the vital information 
is erased. 


The Tampa colleagues are also highly interested in obtaining subscriber information 
regarding the Internet accounts listed on the enclosed letters. Please advise if this is possible 
and/or if more detailed information is needed before the subscriber identification can be provided^ 


Thanks for the assistance. 
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b7E 


Best Regards, 


b6 

b7C 
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DATE Oe-lS-2014 BY F4€MS2KT40 ITS ICG 


fax Ti^ahsmission 

Office of the Leoal Attache 


Working Copy — — 


To; 



CRI 

Date: 

October 26, 2000 


fax #; 
Voice #: 


Pages: 

3, Including this cover sheet. 



Subject: 

Computer Intrusion - Walt Disney World Info System (our file # 288A-TP-51940) 


Case ID : 288A-TP-$1940 


Serial : 20 




™ Working Copy 


P Commits: 

i 

Gentlem^y 

Colleagues In our Florida office, are investigating an apparent cotnputer intrusion 


I | to ^rpetrate the criflf». As is a.lw^ the case, preservation of 

the u^r connection records, maintained by t^ XP, is vital to the sucoessfu) investigation and 
prosecution of this matter. 

Cnclo^ are two "Evidence Preservation" letters which are addressed to the XP in 
question. I^he letters list the sp^ific times and log references which the investigators 
' interested in. Please provide the letters to the XP as soon as possible before the vital 
[ is erased. 

i The Tampa colleagues are also highly interested in obtaining subscriber information 

r^ard.ing the Internet accounts listed on the enclosed letters. Please advise if this is possible 
and/or if more detailed information Is needed before the subscriber identification can be 
provided. 

Thanks for the assistance. 


are 

information 


into the data systems at Walt Disney World in Orlando, Florida. The hacker| 


Best Regards, 



111"! 
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(01/26/1998) 


FEDERAL BUREAU 


Precedence: PRIORITY 

To: Investigative Services 

Tampa 


# 

INVESTIGATION 

Date: 11/07/2000 


Attn: 


From: 






' 


concacc: ALAT 

w 

Approved By: 

Drafted By: 




Case ID #: 288A-TP-51940 (Pending) 

Title: UNSUB (S ); 

WALT DISNEY WORLD - VICTIM; 

INTRUSION - INFO SYSTEM; 

Synopsis: Lead coverage, preservation of evidence letter 

delivered. 

Reference: 288A-TP-51940 Serial 10 

Details: As requested, the preservation of evidence letter 

^provided by Tampa was delivered to the custodian of records a t 

expressed tnerr cooperation wicn tne request 


and stated the e vidence will be Preserved, if it s till exists. 
The attorney foj 
order for Tampa 


The attorney for [advised that in 

to optain private supscriper inrortriation, an 


official legal request, in this case a Mutual Legal Assistance 
Treaty (MI*AT) request, would be necessary. 

If Tampa determines a MLAT request will be sought/ -it 
is recommended the Assistant U - . At-.f-ornfiv ( attsA> in Tampa 
assigned this matter, contact I p f the Office of 

International Affairs (QIA) . Department of Jus^tice (D OJ) , 




3 is the 
a:nd can lend 


Washington D.C., telephone 
attorney responsible for DOJ relations wit _ 
years of expertise in the formulation of a 'mlat request directed 
to that country. 


. • T _ s/lj/ol 


considejcs Tampa serial 1 0^. le^ 1 as covered. 

a 
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$thlAU££0_ 
fll£0. 






To^ 

Re:- 


Irivestigatlv^^ervices From;- 
288A-fP-51940 , .U/07/2000 


LEAD (s) : 

Set Lead 1: (Adm) 

■ ALL RE'CBIV'ING OFFICES 

Please read and clear ACS. 


♦♦ 
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FEDERAL BUREAU OF INVESTIGATION 


^Precedence; ROUTINE Date;. 11/14/2000 

To; Counter Terrorism .Attn; CIU/CIOS/NlPC' 

.Room 11719 


^From;' Tampa' 


Approved By; 
Drafted By;' 
Case ID #; 



Title; .UNSUB (S); 

WALT DISNEY WORLD COMPANY - VICTIM; 
intrusion - INFO SYSTEM;, 

•00: TP ■ 


SUBMISSION: X Initial 


CASE OPENED: 09/26/2000' 


CASE CLOSED: Pending 


COORDINATION: Lega 


fLegat 


Victim 


Company name: Walt Disney World Company - 
Address^ocation: Lake Buena Vista, Florida 

Purpose of System: FTP Server 

Highest classification of information stored in system: Uiiclassified - Company Confidential / 
Patron Information. 
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? 


A 

’m.1 


To: 

;Re; 




Counter .Terrorism , From: Tampa 

288A-TP-51940, “Date .11/1.4/2000 


System Data: 

Hardware/configuration (CPU); Dell OptiPlex - Intel Pentium 
Operating System’XINUX 6.0 - Default install -.no patches 
•Software,". 


, Security=FeaturM: 

Security' Software Instal 
Logon ^Warning Banner; 


1 ^ 





INTRUSION INFORMATION 

rusioh: . X Internet conh^ti 
If Internet; Internet address: 


ion J 



rione Host name: 


Method:' 


Techmque(s) used in intnisionl 


Path of intrusion; 

addresses; Unkhown - although several external IP addresses were found in logs 
and slack space and there is evidence that logs have been modified which indicates that the 
remaining EPs are not from the original comproirase of the computer 
country; 

^facility; 

-Subject(s); Unknown 


Inipact: 


Compromise of classified iriformation;f^ 
Estimated number, of compu ters affect^ 
^Estimated dollar loss to date^ 


n. 


b7E 


2 



• • 

To: Counter Terrorism From: Tampa 

Re: 288A-TP-51940, Date 11/14/2000 


Category of Crime: 

Impairment: 

□ Attempted install- Malicious code 

□ Penial of service 

□ Destnictionofinformation/software 
X Modification of information/software 


Intrusion: 

X Unauthorized access 
□ Exceeding authorized access 


Theft of Information: 

□ Classified information compromised 
X Unclassified information compromised 

□ Passwords obtained 

□ Computer processing time obtained 

□ Telephone services obtained 

O Attempt to obtain Application software 
O Operating software obtained 


REMARKS 


Walt Disney World Security, P.O. Box 


.10000, Lake Buena Vista, Florida, 32830, telephoned and reported 
that a computer system which contains patron personal information 
such as name, address, telephone number and photographs had been 
accessed by an unknown and unauthorized person or persons. 




stated that the victim server (computer) has 
rbiiiiecueu form the network and has not been modified, 
stated that Disney IS personnel are awaiting 
inscruccions from the FBI. 


In a subsequent interview . , 

] stated tnat tne "Leave a 


Legacy" atp^a^ini^ within the EPCOt park, is supported by 
computers 


tt3 

rk 


stated that several SILICON GRAPHICS 
INCORPORATfelTTSGT) computers, with the IRIX operating system (OS) 
and a PC with the 'LINUX operating system may have been accessed 


illegally. | [explained that the LINUX computer was a "File 

Transfer Protocol" (FTP) server which Walt Disney World Company 
used to store "tif" files which are later transferred to KODAK 
COMPANY, and their subcontractors, in order to facilitate the 
making of plaques which are then returned ^o WALT DISNEY WORLD 


and placed on walls within the EPCOT park 




stated that 


EPCOT patrons pay WALT DISNEY WORLD for the service 


LINUX FTP' 
that three 


1 


stated that there are four (4) directo ries on the 
which contained customer data. I 


serve 

(3) of the directories contain files' wnicn 


explained 

are 


encrypted utilizing triple Digital Encryption Standard (DES) and 


b6 
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To: Counter Terrorism From: Tampa 

Re: 288A-TP-51940, Date 11/14/2000 


the fourth directory contained files which were saved in clear 
text. Subsequent investigation revealed that Pretty Good Privacy 
(PGP) was used to encrypt three of the four tif file directories. 


I stated that the clear text files contain^-images , 

names, addresses and phone numbers of -EPCOT patrons, 
explained that the "tif" files normally contained three hundred 
(300) to four hundred (400) individual files and that a "cron 
job" was used to FTP the files to KODAK and other places. 


I [stated that four entities were authorized to 

access the FTP server; KODAK, The Disney Internet Group (DIG) , 
Feathering, a mail order company and the Disney Marketing Group. 


stated that Wednesday afternoon the network 
slowed down ana a large volume of network traffic was noted and 
that is when technicians grew concerned and contacted management, 


b6 

b7C 


explained that their investigation revealed that 
a Firewaii hid been removed from the Internet connection several 
months earlier for an unknown reason and that the removal of the 
firewall -left the FTP Server and associated network segment 
connected to the Internet unprotected. 


stated that also connected to the affected 
segment of the network was a computer which contained executable 
computer code whi ch is us ed to control rides within the parks at 


WALT DISNEY WORLD.] [state that, although remote, it is 

possible that the executable ride control files could have been 
accessed. 


technical 


1 


stated that his staff would provide additional 
aecaiXs and cooperate fully. 


Further investigation revealed that a 

installed and, at a minimum, the following processes were 
trojanizedi 


was 


b7E 


and a additional files were installed 
with subordinatfi-directories of 
Also, a 


-m 


receptively. 

command was executed by victim personnel prior 
to the investigating Agent's arrival and the output was directed 
to a txt file. By comparison of start times and dates, the ps 
command output indicate ^, although pos sibly unreliable due to 
modifications, that the 


was restarted on September 
12, 2000 at 23:06, the iame udue aiiu dpproximate time stamps of 


4 
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FEDERAL BUREAU OF INVESTIGATION. 


D#tc of frjascr^two _ 11/27/2000 

GRAND JURY ^TERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 
Investigating, Agent 


t-Vto 

a ■ lJ^n«a-ra I Kvnyf^aa fvi-^ml L 


b3 
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pursuant to a Grand Jury sunpoena datea 


Investigation oo Tl/21/2000 *t Tampa , Florida 
File# 28ftA-TP-ST94C 



by SA 




P*tc4icutc4 11/27/2000 


b6 

b7C 


This document contwas neither recwnmec^^ conclusions of the FBI. It is the property of the FBI end is loened to your egency; 
it end its contents ere not to be dislritited outside, your egency* 


A 



AO 1 10 (Rtv. 12/89) Subpo^n# to Tistify Befoft GrafKl Jury 


■ p!ntfeh Pistrtct Olmirt 


2000R02543 
GJ NO. >00-1 
SUBPOENANO.I 


— DISTRICT of;— ^ 
ORLANDO DIVISION 


FLORIDA 


SUBPOENA TO TESTIFY 

BEFORE GRAND JURY 

SUBPOENA FOR: 

i i^PERSON < 0 DOCUMENT(S) OR OBJECKS) 

YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the Ur^ed States District Court at 
■ the place, date, and time spedfied below. 



YOU ARE ALSO COMMANDED to bring with you the following documentls) or obje«{s):* 



Please provide documents to: 

Special Aden a 

Federal Bureau of In vestigation 
' 500 East Zack Street 
Tamoa/FL 33602 I 1 

Fa ^P n 

Voice d I 

' O f9e^0 see eddithoet information on ravarsa 

» 

Thte subpoena shall remain in effect imtH you are granted leave to depart by the court or by an officer acting pn 
behalf of the court. 


tYkT. 







October 27; 2000 1 

>r rlk~ 

/^y>< 


. / 


Thi^bpoeha is &sue4^ apptid^ion 
of the United States of America 

DONNAA. BUCELLA* 
United Statsc Attorney 


not tfwer **non«'' 


iNAMLADOftESSANC 


JM8€R Of ASSISTANT U.S. ATTORNEY. 


80 North Hughey Avenue; Suite 201 
Orlando, Florida 32801 407/648-7500 







AO 110<ftev* 12/89) Subpoena to Testify Before Grand Jury 




RETURN OF SERVICE «> 

RECEIVED 
BY SERVER 

1 DATE 


CE 

1 




SERVED 

0 




E£ 

1 

Via 7m ( 

SERVeOON (PRINT N 




1 


TRAVEL 

S6R vices 

TOTAL 

1 DECLARATION OF SERVERC2) | 


SeRVEO 81 


c. — 


b3 
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I declare under penalty of perjury under the laws of the United States of America that the foregoing 


information c ontained in the Retur n of Servi 


Executed on. 




ee$ is tnje and correct. 


Addfss of Server 


AOPJTIONAL INFORMATION 


il) As to wno may serve a subpoena and the manner of Its service see Rule 17(d), Federal Rules of Criminal Procedure, or Rule 45(c), Federal Rules of Civil 

<2)**Fees and "mileage need not be tendered to the witness upon service of a subpoena Issued on behalf of the United States or an officer or agency thereof 
(Rule 45(c), Federal Rules of Civil Procedure* Rule 17(d), Federal Rules of Criminal Procedure) or on behalf of certain Indigent parties and criminal 
defendants who are unable to pay such costs (25 U5C 1S25, Rule 17(b) Federal Rules of Criminal Procedure)**. 
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■ 1 ■ 

FEDERAL BUREAU OF INVESTIGATION 


Date cf traaso^ptioB 01/22/2001 


Date of pirth 

Security Account Nunu xer (SSAN) 


■C;r»r»-i a1 


company, LaKe Buena 
his place of employment by case Agent SA 


information Services, Walt Disney World 
Vista, Florida, was cont-anhpd hPjl^nhnrtinany at 


COMPANY, 


was advised that his company, WALT DISNEY WORLD 
is cne' victi m of a computer crime and that the case Agent 


has evidence of such. 


was the obligation of the case Agent to provide 
company notification . 


|was further advised that a s a victim it 

and his 


Case Agent advised 
had been modified and that a 

Case Agent advised 


IdaalL-logs on the victim computer 
was found. 


that no additional details could 


be provided at this time and that the investigation was ongoing. 


investigitiflo oa 1/22/2001 Tampa , Florida 

File # 288A-TP-51940 



( t elephonical Iv) 


D»te4icuted 1/22/2001 


TIbds document co&t^ms ocii 
it uad its comeuts arc not to be distriKH^SToSuide yew agency. 


iclusions of the FBI, It is the property of the FBI and is loaned to your agency; 


b6 

b7C 

b7E 
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FP"542(Rcv. n-02-1999) 



■ ■■iiiiiM 

HEJRIIM IS ONCUkSSIFIED 

Illllil 




FEDERAL BUREAU OF INVESTIGATION 


Precedence; ROUTINE Date; 02/02/2001 

To ; Tampa 


From; Taparia 




Contact; SA 




Approved By; 
Drafted By; 


Case ID #; 288A-TP-51940 


Title; UNSUB (S): , 

WALT DISNEY WORLD COMPANY - VICTIM; 
INTRUSION - INFO SYSTEM 


b6 

b7C 


Synopsis; Investigative accomplishments report regarding 
captioned matter. 

Details; Interviews with captioned victims conducted. 

I b3 
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To: Tampa FromzWxampa 

,Re:> 288A-TP-51940, 02/02/2001 


Accomplishment Information: 


Number T 

Type: NIPCTP VICTIM CONTACTED/ INTERVIEWED 

ITU': NiPCIP 

claimed By ^ 


Name : 






Number: 1 

Type:; NiPCIP COMPROMISED SITE IDENTIFIED ANO NOTIFIED 
ITU: NIPCIP ) ‘ 

claimed Byi* ■ 


SSN: 

Name 


j: 


♦♦ 




b6 

b7C 

b7E 


I- 1 


U I 


j 


2 



ALL INFOHMATIQN 

HEREIN I S UNCUiJSIEiilH^^^^^ 

DATE OS-1 5-2014 BY F4€I.IS2K'40 NSICG 


Automated Serial Permanent Chargre-Out 
FD-5a (1-5-94) 

Date: 06/06/01 Time: 12:18 


Case. ID:: 288A-TP-51940 Serial: 31 
Description Of Document :- 


Type :- LETTER 

Date ; n:>/i^/ni 

To : 

.From .: US ATTORNEY 


ESQ 


Topic: REQUEST RETURN OF SIGNED PLEA- AGREEMENT 


b6 

b7C 


Reason for Permanent Charge-Out:; 

WRONG FILE NUMBER WRITTEN BY CASE AGENT 
Transferred to:- 

Case ID: 288A-TP-51201 Serial: 77 
Employee: 








n>-542(Rev. U-02.1999) 


kfl^Hfc^ BiiM||il|lilliifcjl 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/14/2001 

To : Tampa 

From: Tartuaa 

Contact: SA 

Approved By: 

Drafted By: 

Case ID #: 288A-TP-51940 (Pending) 

Title: tJNSUB(S); 

WALT DISNEY WORLD COMPANY - VICTIM; 

INTRUSION - INFO SYSTEM 

Synopsis: 2703(d) Court Order obtained and served regarding 

captioned matter. 

Details: A Court Order pursuant to Title 18 U.S.C. Section 




1 


^ ^ ' OTHER Sealed Per Court Order 


b6 

b7C 

b7E 


; I I 

* ^ i iV t 


2HSh-'rP-5nHo 



S 




To^ Tampa From;- ^mpa 
Re; 288A-TP-51940, 03/14/2001 


Accomplishment Information: 

Number;- 1 

-Type; NIPCIP 2703(d) ORDER SERVED' 
ITU; . NIPCIP 

Claimed Byf . 

SSN; L I I 

_ Name:-n . 



} ftLL IMfORMjLTICM 
HEBl IH I S UMVLAS S 
DATE OS-13-2014 BY B4 jilili i ll ll lil 

FIX-542 (Rev, 11-0M»9) 




FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 03/15/2001 


To : Tampa 

From: Ta mpa ^ 

Contact: SA 

Approved By: 

Drafted By: 

Case ID #: 288A-TP-51940 


b6 

b7C 

b7E 


Title: UNSUB (S); 

WALT DISNEY WORLD COMPANY VICTIM; 
INTRUSION - INFO SYSTEM 


Synopsis: 2703(d) Court Order obtained. 

Details: A Court Order pursuant to Title 18 U.S.C. Section 







OTHER Sealed Per Court Order 


2703(d) Court Order served statistic has been claimed in 
PD-542, 288A-TP-51940, Serial 34. 


i 


!' 


t' « 






To: 

Re: 


Tampa From:- ^l^mpa 
288A-TP-51940, 03/15/2001 


Accomplishment Information: 


Number :- 1 

Type:- NIPCIP 2703(d) ORDER OBTAINED 
ITU: NIPCIP 


mea ay. 
SSN:- 
Name: 





b6 

b7C 

b7E 


♦♦ 


2 



DiiillllH^^^ 

FD-3p2(R«v. 10^95) 




iL’ 

FEDERAL BUREAU OF INVESTIGATION 


Date tracscr^pdoa 03/22/2001 


1 


b6 

b7C 


issued pursuant to Title 18 U.S.C 
in his letter that 


voluntarily provided the enclosed 
in response to a. 

Section 2703 (d) . I 


one (1) page letter. The letter is in response to a, rmirr or der 

states 


requested via the Court Order. other sealed Per court order 

The letter is provided to the file this day. 








^ * 

^ ‘Ti 

i w L t 

in 4 

i ' ' u 


‘ L 



Xnvcstigatioo co 2 f 2212001 Tampa , Florida^ 



This 4ocumcttt c^itlos neither rccommen<5a.ti<>ns x»r ccmclusioas of the FBI. It is the property of the FBI and is loaned to your agency; 
it and ita contenU axe not to be distributed outside your agency. y. i > 


b6 

b7C 



ALL IMFSi MAl lli l ll l i lM 

HEBEIH IS 

DATE 08-1 Piltilllta 





Automated Serial Permanent Charge-Out 
FD-5a. (1-5-94) 

Date: 09/05/01 Time: 08:23 


Case ID:; 288A-tP-51940 Serial: 37 


Description of Document : 


Type 
.Date, : 
To : 
Frorti : 
Tdpic l: 


INSERT 
04/18/01 
TAMPA 
TAMPA‘ 


Reason for Permanent Charge-Out:; 


.AGENT requested TO DELETE AND SERIALIZE CORRECTED COPY. 
Employee:; 


b6 
b7C 
b7E ; 





rf- 



ALL IMTORmTION CONTAINED 
HEREIN IS UffiTLASSIFIED^ 

DATE 08- 19-2014 BY F4€MS2K40 NS ICG 





288A-TP-51940 

RVH;rvh 


1 


On this date, April 18, 2001, Special Agent 
Iforwarded a ^ draft of a r equest for assistance from the 

pursuant to a- Mutua l Assistance 
Treaty to Aaaistant Ilnitaa Statf>H Attorney (AUSA) V 
is to review the docume^nt and forwarded it, ' 


corrections, to the Department of Justice, 
final approval amd. forwarding. 


ana any 
Washington, D.C. 


for 


b6 

b7C 

b7E 


/ 

\ 







JILL iMfCBmfioH ^J2injamn 
EEFMIM I i 

DATE 08-19-2014 BY F46M82E40 MSICG 

(Rcv.OS-28-2000) 




FEDERAL BUREAU OF INVESTIGATION 


Precedence * ROUTINE 


Date* 12/10/2002 


To* Tampa 
From* Tamna_ 


Cyb er Crimes 
SA^ 


concacc* 

Approved By* 

Drafted By* 

Case ID #* 288A-TP-51940 (Pending) 


Title* UNSUB (S); 

WALT DISNEY WORLD COMPANY - VICTIM; 
INTRUSION - INFO SYSTEM 


Synopsis* EC to file documenting telephonic contact with AUSA 

regarding a pending Mutual Legal Assistance Treaty 
U''iLAT) request. 


Details* Per telephonic contact with AUSA 




T request re ga rding cap t ioned matter 


December 10, 2002, the m: 

remains pending with the 

confirmed the matter remains pending via the Office of 
International Affairs (OIA) , USDOJ, Washington, D.C. 


on 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


♦♦ 





ALL INFOHMATION CXMTAINED 
HEREIH IS UNC'LASSIITED: 

DATE OS-13-2014 3Y F4€if82K40 USIDG 

1FIX-J02 (Rev; 10-6-95) 




I 



FEDERAL BUREAU OF INVESTIGATION 


Date treaseryticn 05 / 20/2003 


Special Agent 


received' the attached^ 


hhreft ( 3 ) naap document trom Assiscanc uhited.«States Attorney 


on the afternoon, of May 20, 2003. The document is a 
fApiy T.fl a fnr' fiatia Via Mnhnai Assistance ' Treaty 


b6 

b7C 

b7E 


(MLAT) frod 


The reply ^from 


is. dated March 27, 


2003 and the accompanying cover sheet is dated. May 19, 2003 

Subject document is entered into the. file this date. 


lavestijatioo co . 5 / 20/2003 *« Tampa , Florida 

288A-TP-51940"V^ 

by SA( 




Date dictated N/A 


b6 

b7C 


Th» dcNjumca^t codtaioa jicithey m j* i>tgfetosioos of the FBI. It is the pf operty cf* the FBI and is leaned to yew a-gency; 

it and its coftots are iliot to be distributed outside your sgency. 





05/19/2009 19:00 FAX 


liJOOl 






U.S. Department of justice 

Criminal Division 


WashuigTCtt, D-C. 20530 


TELEFAX transmittal sheet 


DATE: May 19, ,2003 


TO: I I 

Assistant United States Attorney 
Middle District of Florida 
U.S. Att orney's Office 
Telefax: I I 


FROM: 


SUBJECT: 

REFERENCE: 


Mary Ellen Warlow 
Director 

OFFICE OF INTERNATIONAL AFFAIRS 
CRIMINAL DIVISION 



For: 


Senior Trial Attorney 


b6 

b7C 

b7E 


MESSAGE: 


Please see t he attached copy of a fax from 

regarding the execution of this zregue'st. 


Number of pages: 
Telephone number: 
Telefax number: 
E-mail address : 


I 

s 


fiAnt .TMB 




I 




ItLL IMUCUmflQM CQFTMHED 
HIESIM IS UWOJlSSIFIin: 

D&TE OS-13-2014 3Y r4SfS2K40 HS 


fI>-$0KRcv, 745-97) 


FEDERAL BUREAU OF INVESTIGATION 


"'Precedence: ROUTINE Date:; 05/20/2003 

To: Cyber Attn: CCIU 

Rootti 5965, SSA^ 

From: Tampa 

Approved By: 

Drafted By 


b6 

b7C 


Case ID #: 288A-fP-51940 

Title: UNSUB (S); 

WALT DISNEY WORLD - VICTIM; 
INTRUSION - INFO SYSTEM; 


SUBMISSION: Final; 


CASE OPENED: 09/29/2000 


CASE CLOSED: 05/21/2003 


i 

COORDINATION: Lega 




Victim 


MEAT request which produced no evidence. 


b7E 


, Company name: Walt Disney World Company 
Address^ocation: Lake Buena Vista, Florida 


Purpose of System: FTP server 

“Highest classification of information stored in system: Unclas^sified 
System Data: 

.Hardware/configuration (CPU): Intel 
Operating System: Red Hat 6.0 
Software; 

Security Features: 

Security Software Instal led] 

Logon Warning Banner.* ! 

INTRUSION INFORMATION 

Access for intrusion: X Internet (TCP/IP) 



L' _ 




To : Cyb e r From : ^ramp a 

Re: 288A-TP-51940, Date 05/20/2003 


/ 

Method: Technique(s) used in intrusion; believed to bJ 


Subject 1: tJNSUB(S); 


Impact: _ 

Compromise of classified information: I 
Estimated number of computers affec ted 
Dollar.loss to date: 



t • 


To: Cyber From: '^ampa 

Re: 288A-TP-51940, Date 05/20/2003 



Category of Crime: 

Impairment: 

O Attempted install- Malicious code 
O Denial of service 
□ Destnictionofinformation/software 
O Modification of information/software 


Theft of Information: 

□ Classified information compromised 
X Unclassified information compromised 
D Passwords obtained 

□ Computer processing time obtained 
O Telephone services obtained 

O Attempt to obtain Application software 


Intrusion: 

X Unauthorized access 


REMARKS 


Per MLAT response received from the 
dated March 23, 2003 and received by the tJ.S. Attorney's Office, 

Middle District of Florida, on May T9, . 2003 no information was 

available regarding subject IP address 


date. 


No further logical leads to pursue. 

writer recommends captioned matter be closed this 


b7E 


♦♦ 


f 


3 



